Server-Side Request Forgery Vulnerability in Tapo Cloud by TP-Link
CVE-2026-105822

8.3HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Tapo Cloud Service
Vendor
CVE Published:
3 November 2026

What is CVE-2026-105822?

The Tapo Cloud service from TP-Link is susceptible to a server-side request forgery (SSRF) vulnerability, stemming from inadequate input validation of user-controlled host values. An attacker could exploit this flaw, potentially leading the Tapo Cloud service to make requests to malicious servers. This exploitation could compromise internal data, potentially facilitating further attacks such as Distributed Denial-of-Service (DDoS) incidents.

Affected Version(s)

Tapo Cloud Service 0

References

https://www.tp-link.com/us/support/faq/5370/
vendor-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

davidsclee (davidleesecurity.co.uk)
.